When an object requires a symbol, the runtime linker searches for that symbol based upon the requesting object's symbol search scope, and the symbol visibility offered by each object within the process. These attributes are applied as defaults to an object at the time the object is loaded, as specific modes to dlopen(3DL), and in some cases can be recorded within the object at the time it is built.
Typically, an average user becomes familiar with the default symbol search models that are applied to a dynamic executable and its dependencies, and to objects obtained through dlopen(3DL). The former is outlined in the next section Default Lookup, and the latter, which is also able to exploit the various symbol lookup attributes, is discussed in Symbol Lookup.
An alternative model for symbol lookup is provided when a dynamic object employes direct bindings. This model directs the runtime linker to search for a symbol directly in the object that provided the symbol at link-edit time. See Direct Binding.
A dynamic executable and all the dependencies loaded with it are assigned world search scope, and global symbol visibility. See Symbol Lookup. When the runtime linker looks up a symbol for a dynamic executable or for any of the dependencies loaded with the executable, it does so by searching each object. The runtime linker starts with the dynamic executable, and progresses through each dependency in the same order in which the objects were loaded.
As discussed in previous sections, ldd(1) lists the dependencies of a dynamic executable in the order in which they are loaded. Therefore, if the shared object libbar.so.1 requires the address of symbol foo to complete its relocation, and this shared object is a dependency of the dynamic executable prog:
$ ldd prog libfoo.so.1 => /home/me/lib/libfoo.so.1 libbar.so.1 => /home/me/lib/libbar.so.1 |
The runtime linker first looks for foo in the dynamic executable prog, then in the shared object /home/me/lib/libfoo.so.1, and finally in the shared object /home/me/lib/libbar.so.1.
Symbol lookup can be an expensive operation, especially when the size of symbol names increases and the number of dependencies increases. This aspect of performance is discussed in more detail in Performance Considerations. See Direct Binding for an alternative lookup model.
The runtime linker's default mechanism of searching for a symbol first in the dynamic executable and then in each of the dependencies means that the first occurrence of the required symbol will satisfy the search. Therefore, if more than one instance of the same symbol exists, the first instance interposes on all others. See also Shared Object Processing.
When creating an object to use direct bindings, the relationship between the referenced symbol and the dependency that provided the definition is recorded in the object. The runtime linker uses this information to search directly for the symbol in the associated object, rather than carry out the default symbol search model. Direct binding information can only be established to dependencies specified with the link-edit. Therefore, use of the -z defs option is recommended.
Direct bindings can be established with one of the following mechanisms.
With the -B direct option. This option establishes direct bindings between the object being built and all its dependencies. The use of -B direct also enables lazy loading, which is equivalent to adding the option -z lazyload to the front of the link-edit command line. See Lazy Loading of Dynamic Dependencies.
With the -z direct option. This option establishes direct bindings between the object being built and any dependencies that follow the option on the command line. This option can be used together with the -z nodirect option, to toggle the use of direct bindings between dependencies.
With the DIRECT mapfile attribute. This attribute provides for directly binding individual symbols. The alternative attribute NODIRECT, can be used to prevent direct binding to individual symbols. See Defining Additional Symbols.
The direct binding model can significantly reduce the symbol lookup overhead within a dynamic process that has many symbolic relocations and many dependencies. This model also enables multiple symbols of the same name to be located from different objects that have been bound to directly.
Direct binding can circumvent the traditional use of interposition symbols because it bypasses the default search model. The default model ensures that all references to a symbol bind to one definition.
Interposition can still be achieved in a direct binding environment, on a per-object basis, if an object is identified as an interposer. Any object loaded using the environment variable LD_PRELOAD
or created with the link-editor's -z interpose option, is identified as an interposer. When the runtime linker searches for a directly bound symbol,
it first looks in any object identified as an interposer before it looks in the object that supplies the symbol definition.
Direct bindings can be disabled at runtime by setting the environment variable LD_NODIRECT
to a non-null value.
Some interfaces exist that offer alternative implementations of a default technology. These implementations also assume they are the only instance of that technology within a process. An example of this is the malloc(3C) family. Directly binding to interfaces within such a family should be avoided, as it is possible for more than one instance of the technology to be referenced by the same process. For example, one dependency within a process may directly bind against libc.so.1, while another dependency directly binds against libmapmalloc.so.1.
Objects that provide a single implementation for a process, should define the interfaces to that implementation using the mapfile directive NODIRECT. This directive insures no users directly bind to an implementation, but use the default symbol search model.
NODIRECT mapfile directives can be combined with the command line options -B direct or -z direct. Symbols that are not explicitly defined NODIRECT will follow the command line directive.